Tenth Circuit Says Pretextual Inventory Searches Need To Be A Whole Lot Less Pretextual

from the mic-is-hot,-boys dept

One of the great warrant exceptions is the "inventory search." Stop a car in a high-traffic or "high crime" area, and officers will feel compelled to tow it away. But before it's towed, they'll make a list of everything in the car to ensure the vehicle's owner gets all of their possessions back when they retrieve it from the impound lot. If there happens to be contraband in the car, it's a win for the cops. The "discovery" (even if derived from a mostly-pretextual search) will be called "inevitable" and can be used against the person to deprive them of their freedom along with their car.

This one simple trick usually works out for law enforcement. But every so often it doesn't. And when it doesn't work, it's usually because officers were in such a hurry to carry out the warrantless search that they completely forgot about the pretext.

That's the case here in the Tenth Circuit Appeals Court's handling of a motion to suppress. The lower court denied the suppression motion, but the Appeals Court reverses [PDF] that decision, finding that the officers created an excuse to search the car, making their discoveries less than inevitable.

It all started with a call to the Tulsa (OK) Police Department about Evan Woodard. The caller said Woodward was in the middle of a drug case, may have smoked PCP, had three previous gun charges, and had violated a protective order. Tulsa PD officers headed out to find Woodard and serve him with an outstanding warrant for public intoxication and the protective order he was allegedly violating.

Here's what happened next:

Police officers found Mr. Woodard in Tulsa, Oklahoma, at about 8:00 a.m. and initiated a traffic stop. Mr. Woodard pulled into a parking lot at a QuikTrip convenience store and stopped there. The police told Mr. Woodard to get out of the car, arrested him based on the warrant, and took his cellphone. Mr. Woodard then asked if he could call someone to pick up the car. One of the police officers responded “I don’t think so,” and the police decided to impound the car.

But it wasn't that simple. The stop and search were captured on the officers' body cameras, which caught them saying things that made it clear they were looking for an excuse to search the car, rather than performing a regular inventory in preparation for towing the vehicle from the convenience store parking lot.

One officer looked in the panel on the driver’s side door and on the floor under the driver’s seat, saying that Mr. Woodard was “fighting a huge drug case.” Defendant’s Mot. to Suppress, Exh. 4 (body camera). The other officer replied that Mr. Woodard liked PCP. As the officer replied, he opened the center console.

One officer commented that he was looking for verification of car insurance, expressing doubt that Mr. Woodard had insured the car. After seeing no verification in the center console, he eventually found proof of an old insurance policy in the glove compartment. By then, however, another officer had found marijuana, cocaine, a digital scale, and a gun.

Using this evidence -- as well as some information from another traffic stop of Woodard in Bartlesville, Oklahoma that resulted in the discovery of drugs and a gun -- officers obtained a warrant to search Woodard's phone. Text messages recovered from the phone indicated Woodard was dealing drugs.

Prior precedent from this circuit restricts officers' ability to impound vehicles, which, accordingly, also limits their ability to search vehicles without a warrant.

These heightened requirements allow impoundments from private property, like the impoundment of Mr. Woodard’s car, only when (1) the car is blocking traffic, (2) the car is posing an imminent threat to public safety, or (3) the impoundment is justified by a standardized policy and a reasonable, non-pretextual rationale of community caretaking.

The Tulsa PD's impound policies comply with this precedent. As conceded by the state, officers can only impound a car if the vehicle is blocking the "public way" or, if the vehicle is stopped on private property, the traffic stop "follows an offense committed on the public way." In this case, the stop didn't follow a traffic violation. It was performed to serve a warrant and protective order.

Hence, the impounding and the attached search were unjustified. And the government's arguments can't change that.

The police stopped Mr. Woodard to serve a protective order and execute an arrest warrant for public intoxication. The protective order and warrant were pieces of paper, not offenses. The only offense was public intoxication, and the intoxication did not take place on a public way.

The government contends that Mr. Woodard was stopped for a continuing offense: failing to pay costs for his charge of public intoxication. But failing to pay court costs is not a continuing offense.

Plus, there were things said by officers that made it clear they were really interested in searching the car, rather than ensuring it wasn't left on private property where it might have bothered the owner of the convenience store or been molested by an unspecified criminal element (based on the government's contention the QuikTrip was in a "high crime area").

While the government presented a long list of reasons it could have impounded the car (lack of proof of insurance, Woodard's lack of a valid drivers license, concern over ownership, evidence of a crime, etc.), the officers stated none of these reasons before performing the search, nor after it. These reasons didn't make an appearance until the search was challenged, indicating the impound was mere pretext for the warrantless search of the car.

Also indicative were statements like these:

Not only does every factor point toward pretext, but other powerful evidence of pretext exists. Before searching the car, the police officers discussed how to proceed and the senior officer declared his intent to “friggin’ light [Mr. Woodard] up with whatever we can.”

[...]

As the police started the search, one officer said that Mr. Woodard was fighting a big drug case and facing three gun charges. The other officer said that Mr. Woodard liked PCP, adding that he had been “digging around” the center console area, and the officer began his search there. Defendant’s Mot. to Suppress, Exh. 4 (body camera), Exh. 5 (body camera). These statements and actions showed the officers’ intent to look for drugs, not to safeguard the car and its contents

And the government couldn't even come up with any plausible excuse for the first officer's statement:

At oral argument, the government surmised that the officer might have meant only that he wanted to cite Mr. Woodard for whatever violations could be proven at the time of the decision to impound the car. This explanation is new and illogical. The explanation is new because the government never suggested in district court that this is what the officer had meant. The explanation is also illogical. The command to “light [Mr. Woodard] up with whatever we can” shows that the officer wanted to look for new evidence. The phrase cannot plausibly be interpreted to mean that the officer wanted only to bolster the public intoxication charge and serve the protective order.

The conclusion? The Tulsa PD is wrong and so is the lower court for approving these actions.

Because the Tulsa Police Department’s standardized policy did not apply and the stated rationale for impoundment was pretextual, the district court erred in denying the motion to suppress evidence of the drugs, digital scale, gun, and cellphone found in the Tulsa search.

With that evidence gone, so are the text messages taken from the search of the phone. Without those text messages implicating Woodard in drug distribution, the charges in the other stop in Bartlesville are reversed as well, leaving the officers with nothing but a couple of illegal searches.

Filed Under: 10th circuit, evan wodard, excuses, oklahoma, police, pretextual searches, tulsa

Facebook Acting Badly: Shuts Down Researchers Accounts Over Claims Of Privacy Violations That Don't Stand Up To Scrutiny

from the oh-stop-it dept

Last year we wrote about Facebook threatening NYU researchers who had set up a browser extension that would allow users to voluntarily collect information about ads and ad targeting on Facebook -- information that Facebook does not publicly reveal -- and provide it to the researchers' "Ad Observatory" project. As we noted at the time, Facebook's threats were definitely going too far, though you could see how it came about, as it could be argued that there were technical similarities to what the NYU researchers were doing, and what an academic from Cambridge did many years ago that turned into... the Cambridge Analytica scandal, which resulted (in part) in a massive fine from the FTC for privacy violations.

But, as we explained then, the NYU Ad Observer story is clearly distinguishable from the Cambridge Analytica story. The Ad Observatory involves people installing an extension on their own computer in their own browser, and choosing to share that information. That's not something Facebook should have any right to block.

Unfortunately, this week, Facebook took things up a notch and shut down the accounts of everyone associated with the project, effectively cutting off all their access to Facebook's Ad Library and other tools they were using in their research. Facebook's own explanation for this is... to claim that it was compromising people's privacy, though that appears to be bullshit (as we'll get to in a moment). Here's part of what Facebook said:

We told the researchers a year ago, in summer of 2020, that their Ad Observatory extension would violate our Terms even before they launched the tool. In October, we sent them a formal letter notifying them of the violation of our Terms of Service and granted them 45 days to comply with our request to stop scraping data from our website. The deadline ended on November 30, long after Election Day. We continued to engage with the researchers on addressing our privacy concerns and offered them ways to obtain data that did not violate our Terms. 

Earlier this year, we invited researchers, including the ones from NYU, to safely access US 2020 Elections ad targeting data through FORT’s Researcher Platform. This offered the Ad Observatory researchers a more comprehensive data set than the one they created by scraping data on Facebook. The researchers had the opportunity to use the data set, which is designed to be privacy-protective, instead of relying on scraping, but they declined.

We made it clear in a series of posts earlier this year that we take unauthorized data scraping seriously, and when we find instances of scraping we investigate and take action to protect our platform. While the Ad Observatory project may be well-intentioned, the ongoing and continued violations of protections against scraping cannot be ignored and should be remediated. 

Collecting data via scraping is an industry-wide problem that jeopardizes people’s privacy, and we’ve been clear about our public position on this as recently as April. The researchers knowingly violated our Terms against scraping — which we went to great lengths to explain to them over the past year. Today’s action doesn’t change our commitment to providing more transparency around ads on Facebook or our ongoing collaborations with academia. We’ll continue to provide ways for responsible researchers to conduct studies that are in the public interest while protecting the security of our platform and the privacy of people who use it. 

This is... nonsense. I challenge the idea that "data scraping" is a problem, first of all. I mean, that's what the entire search engine business is built on. It's all data scraping. The problem is when private information is somehow exposed. But that's different. And here we're talking about individuals installing an extension in their own browsers, to collect information that is sent to their own computers. That's not Facebook's data to control. Once it's in my browser, it's mine to make use of. Facebook's argument here makes no sense.

And, indeed, a few others have stepped in to point out the same thing. For one, Mozilla, makers of the Firefox browser, called bullshit on the claims pretty directly:

Facebook claims the accounts were shut down due to privacy problems with the Ad Observer.  In our view, those claims simply do not hold water. We know this, because before encouraging users to contribute data to the Ad Observer, which we’ve done repeatedly, we reviewed the code ourselves. And in this blog post, we want to explain why we believe people can contribute to this important research without sacrificing their privacy.  

Anytime you give your data to another party, whether Facebook or Mozilla or researchers at New York University, it is important that you know whether that party is trustworthy, what data will be collected, and what will be done with that data. Those are critical things to consider before you potentially grant access to your data. And those are also key factors for Mozilla when we consider recommending an extension. 

Before Mozilla decided to recommend Ad Observer, we reviewed it twice, conducting both a code review and examining the consent flow to ensure users will understand exactly what they are installing. In both cases the team responsible for this add-on responded quickly to our feedback, made changes to their code, and demonstrated a commitment to the privacy of their users. We also conducted an in-depth design review of Ad Observer, the results of which can be found here. 

We decided to recommend Ad Observer because our reviews assured us that it respects user privacy and supports transparency. It collects ads, targeting parameters and metadata associated with the ads. It does not collect personal posts or information about your friends. And it does not compile a user profile on its servers. The extension also allows you to see what data has been collected by visiting the “My Archive” tab. It gives you the choice to opt in to sharing additional demographic information to aid research into how specific groups are being targeted, but even that is off by default.

You don’t have to take our word for it. Ad Observer is open source, so anybody can see the code and  confirm it is designed properly and doing what it purports to do.

And then, the FTC's Bureau of Consumer Protection weighed in with a letter to Mark Zuckerberg also calling bullshit on the idea that the Ad Observatory extension might somehow violate Facebook's various consent decrees with the FTC regarding privacy protection.

I write concerning Facebook’s recent insinuation that its actions against an academic research project conducted by NYU’s Ad Observatory were required by the company’s consent decree with the Federal Trade Commission. As the company has since acknowledged, this is inaccurate. The FTC is committed to protecting the privacy of people, and efforts to shield targeted advertising practices from scrutiny run counter to that mission.

While I appreciate that Facebook has now corrected the record, I am disappointed by how your company has conducted itself in this matter. Only last week, Facebook’s General Counsel, Jennifer Newstead, committed the company to “timely, transparent communication to BCP staff about significant developments.” Yet the FTC received no notice that Facebook would be publicly invoking our consent decree to justify terminating academic research earlier this week.

Had you honored your commitment to contact us in advance, we would have pointed out that the consent decree does not bar Facebook from creating exceptions for good-faith research in the public interest. Indeed, the FTC supports efforts to shed light on opaque business practices, especially around surveillance-based advertising. While it is not our role to resolve individual disputes between Facebook and third parties, we hope that the company is not invoking privacy – much less the FTC consent order – as a pretext to advance other aims.

I do think that some of the pressures that people put on Facebook about "protecting" privacy do more harm than good and lead to situations that backfire and actually give Facebook more control and less transparency. But this case seems to be Facebook cynically using this as an excuse to shut down academic research they were uncomfortable with and punish the researchers.

There are two simple answers here: give the academic researchers access to the data they need to do this research (Facebook's claims of making the data accessible leave out that not everything the researchers are asking for is actually in those data sets) and don't block people from installing things on their own computer. That's not Facebook's job.

Filed Under: ad observatory, data, excuses, ftc, privacy, scraping, transparency
Companies: cambridge analytica, facebook, mozilla, nyu

Privacy Laws Giving Big Internet Companies A Convenient Excuse To Avoid Academic Scrutiny

from the that's-unfortunate dept

For years we've talked about how the fact that no one really understands privacy, leads to very bad attempts at regulating privacy in ways that do more harm than good. They often don't do anything that actually protects privacy -- and instead screw up lots of other important things, from competition to free speech. In fact, in some ways, there's a big conflict between open internet systems and privacy. There are ways to get around that -- usually by moving the data from centralized silos out towards the ends of the network -- but that's rarely happening in practice. I mean, going back over thirteen years ago, we were writing about the inherent conflict between Facebook's (then) open social graph and privacy. Yet, at the time, Facebook was cheered on for opening up its social graph. It was creating a more "open" internet, an internet that others could build upon.

But, of course, over the years things have changed. A lot. In 2018, after the Cambridge Analytica scandal, Mark Zuckerberg more or less admitted that the world was telling Facebook to lock everything down again:

I do think early on on the platform we had this very idealistic vision around how data portability would allow all these different new experiences, and I think the feedback that we’ve gotten from our community and from the world is that privacy and having the data locked down is more important to people than maybe making it easier to bring more data and have different kinds of experiences.

As we pointed out in response -- this was worrisome thinking, because it would likely take us away from a better world in which the data is more controlled by end users. Instead, so many people have now come to think that "protecting privacy" means making the big internet companies lock down our data rather than the much better approach which would be giving us full control over our own data. Those are two different things, that only sometimes look alike.

I say all of that as preamble in suggesting people read an excellent Protocol article by Issie Lapowsky, which -- in a very thoughtful and nuanced way -- highlights the unfortunate conflict between academic researchers trying to study the big internet companies and the companies' insistence that they need to keep data private. We've touched on this topic before ourselves, in covering the still ongoing fight between Facebook and NYU regarding NYU's Ad Observer project.

That project involves getting individuals to install a browser extension that shares data back to NYU about what ads the user sees. Facebook insists that it violates their privacy rules -- and points to how much trouble it got in (and the massive fines it paid) over the Cambridge Analytica mess. Though, as we explained then, the scenarios are quite different.

Lapowsky's article goes further -- noting how Facebook told her that the Ad Observer project was collecting data without the user's permission, which worried the PhD student who was working on the project. It turns out that was false. The project only collects data from the user who installs it and agrees (giving permission) to collect the data in question.

But the story and others in the article highlight an unfortunate situation: the somewhat haphazard demands on the big internet companies to "protect privacy" are now providing convenient excuses to those same companies to shut down academic research on those companies and their practices. In some cases there are legitimate concerns. For example, as the article notes, there were concerns about how much Facebook is willing to share regarding ad targeting. That information could be really important for those studying disinformation or civil rights issues. But... it could also be used in nefarious ways:

Facebook released an API for its political ad archive and invited the NYU team to be early testers. Using the API, Edelson and McCoy began studying the spread of disinformation and misinformation through political ads and quickly realized that the dataset had one glaring gap: It didn't include any data on who the ads were targeting, something they viewed as key to understanding advertisers' malintent. For example, last year, the Trump campaign ran an ad envisioning a dystopian post-Biden presidency, where the world is burning and no one answers 911 calls due to "defunding of the police department." That ad, Edelson found, had been targeted specifically to married women in the suburbs. "I think that's relevant context to understanding that ad," Edelson said.

But Facebook was unwilling to share targeting data publicly. According to Satterfield, that could make it too easy to reverse-engineer a person's interests and other personal information. If, for instance, a person likes or comments on a given ad, it wouldn't be too hard to check the targeting data on that ad, if it were public, and deduce that that person meets those targeting criteria. "If you combine those two data sets, you could potentially learn things about the people who engaged with the ad," Satterfield said.

Legitimate concern... but also allows the company to shield data that could be really useful to academics. Of course, it doesn't help that so many people are so distrustful of these big companies that no matter what they do it will be portrayed -- sometimes by the very same people -- as evil. It was just a few weeks ago that we saw people screaming both about the big internet companies willing to cave in and pay Rupert Murdoch the Australian link tax... and when they refused to. Both options were painted as evil.

So, sharing data will inevitably be presented by some as violating people's privacy, while not sharing data will be presented as hiding from researchers and trying to avoid transparency. And there's probably some truth in every angle to these stories.

Of course, that all leaves out a better approach that these companies could do: give more power to the end users themselves to control their own data. Let the users decide what data is shared and what is not. Let the users decide where and how that data is stored (even if it's not on the platform itself). But, instead, we just have people yelling about how these companies both have to protect everyone's privacy and give access to researchers to see what they're doing with all this data. I don't think the "middle ground" laid out in the article is all that tenable. Right now it's just to basically create special exceptions in which academics are "allowed" -- under strict conditions -- to get access to that data.

The problem with that framing is that the big internet companies still end up in control of the data, rather than the end users. The situation with NYU seems like a perfectly good example. Facebook shouldn't have to share data from people who don't consent, but with the Ad Observer, it's all people who are actually consenting to handing over their own data, and Facebook shouldn't be in the business of blocking that -- even if it's inevitable that some reporter at some future date will try to spin that into a story claiming that Facebook "violated" privacy because these researchers convinced people to turn over their own info.

Filed Under: academic research, excuses, privacy, privacy laws
Companies: facebook

Providing Electronic Access To Public Records Is 'Expensive' And Other Government Excuses For PACER Fees

from the well,-if-you're-not-going-to-give-it-away,-i-guess-we'll-just-have-to-go dept

Steve Schultze at Freedom to Tinker wants to know why the general public is still being asked to pay for access to public records. Since these records are generated using tax dollars, a person would reasonably expect they would be free to access, especially since they're the ones footing the bill. Of course, reasonable expectations are shattered by government entities daily and PACER is no exception.

As Mike noted in 2011, the fees to electronically access PACER records continue to rise, even as costs drop, leaving most Americans locked out by prohibitive fees (and a less-than-intuitive user interface). Schultze notes that not only are these fees excessive, they very likely are illegal.

[L]et’s review the law. 28 U.S.C. 1913 (note) says:

"The Judicial Conference may, only to the extent necessary, prescribe reasonable fees… to reimburse expenses incurred in providing these services."

Upon passing the E-Government Act of 2002, Congress noted its intent for the “only to the extent necessary” language:

The Committee intends to encourage the Judicial Conference to move from a fee structure in which electronic docketing systems are supported primarily by user fees to a fee structure in which this information is freely available to the greatest extent possible. For example, the Administrative Office of the United States Courts operates an electronic public access service, known as PACER, that allows users to obtain case and docket information from Federal Appellate, District and Bankruptcy courts, and from the U.S. Party/Case Index. Pursuant to existing law, users of PACER are charged fees that are higher than the marginal cost of disseminating the information.

The current fees are unquestionably greater than the cost of providing the services. Since passage of the E-Government Act, the cost of storing and delivering bits of data over the Internet has continued to fall precipitously, and the cost of PACER access has gone up by 42 percent.

To that end, Schultze has drafted a bill entitled the Open PACER Act, which provides for "free and open access to electronic federal court records." The draft bill is dedicated to the memory of Aaron Swartz (whose "abuse" of a limited-time free access offer greatly helped give the RECAP project momentum) and is open for comment at openpacer.org. (Schultze himself assisted Swartz in this venture, putting together the Perl script for automating the PACER downloads. Shultze had plans for a "thumb drive corps" of volunteers to hit multiple libraries and utilize the free access to download millions of documents. However, Swartz struck out on his own, scraping PACER via Amazon cloud servers, leading directly to his first contact with the FBI.)

Now, we all know why we think these documents should be freely available. Now, it's time to hear from the judicial system. Schultze runs through the many reasons the government thinks we should keep on paying, summarized from a list of excuses fact sheet entitled "Electronic Public Access Program Summary: December 2012." He compiles a list of 10, all worth reading (and mocking), but here are a few of the better (pejorative form) ones.

Excuse #1: “PACER is cheap”

Whether or not PACER is subjectively inexpensive is immaterial. The law says that the fees can only reimburse for the expense of the service, and the courts are charging more than that. End of story. Nevertheless, PACER is — subjectively — expensive. Although it costs “only 10 cents per page,” the system charges not only per page for documents, but per “page” of search results, and per “page” of docket listings. It is easy to quickly run up a huge bill unless you are looking for one particular thing and you know exactly how to find it.

10 cents per page might sound like a standard library charge for printouts or copies, but we're talking about electronic access, where accessing 1,000 pages has no discernible effect on the "cost" of retrieving the documents. And charging per page or search results or docket listings? That's like having a surcharge added to your restaurant check for "accessing" the menu before ordering. The ridiculous search results charge is even more insulting considering how poorly PACER's search function performs.

Excuse #6: “You can always go to the courthouse”

This is a good one. The Administrative Office will tell you that you can go to your local courthouse to access PACER records for free. Well, maybe not “local,” but you can go to the district, bankruptcy, or circuit courthouse and access PACER. Of course, you can only access records for that particular court. You can’t access other PACER records. You also can’t download the records. You can only view them. If you want to print them, that will be 10 cents per page. That’s not legal.

lol

No. Seriously. Dry-as-straight-vermouth-in-the-Sahara "lol," the sort of laugh hastily assembled from equal parts of disbelief and disgust that inadvertently escapes you blindsided with the least helpful advice ever. Citizen: "I wish to electronically access several public records for free." Administrator: "Do you own a car?"

Not only is this suggestion utterly worthless, it's the height of bureaucratic obtuseness. Equating "a drive to the courthouse" with "electronically accessing the total of the PACER system on my schedule" is the sort of logic only deployed by someone who wishes to appear helpful but not actually help anybody. To top it off, you can only search that specific location's documents and then MEMORIZE ALL PERTINENT INFORMATION or you're back to 10 cents a page. No downloading allowed. Beautiful.

Excuse #8: “There is a high cost to providing electronic public access”

Here is how the PACER system architecture works: every court runs its own local PACER server, with local support staff and a private leased network link to Washington, DC. Are you a system administrator? Are you an average citizen who has heard the word “cloud” in the past five years? Does this system architecture seem insane? It is. It is even more offensive in light of the fact that the GSA has had, for years, a streamlined government procurement system for cloud hosting. This system is certified at FISMA level 2 security, and is hosted in a “private cloud” for the government, which is good enough for the Department of Homeland Security. It is provided by companies like Amazon at only a fraction higher cost than their commercial offerings. The courts could host all of the PACER services in the cloud — tomorrow — for under $1 million per year. They could allow all of these local system administrators to control their own PACER installations. They could obtain greater cost savings (and security) by further consolidating PACER hosting and system administration. Of course, they feel no pressure to do so when they interpret the law to allow them to charge whatever they deem necessary.

No one's denying there are costs associated with providing electronic access. But a majority of those costs flatten dramatically once the documents are uploaded. Compare that to "driving down to the courthouse," which ties up however many employees it takes to get you up and running on their local PACER service, not to mention staffers taking phone calls from those unwilling to cough up 10 cents a page for an updated docket listing.

Not only is the complaint about costs ridiculous, but taxpayers are being double-dipped for some of these fees. Taxpayers fund the generation of the documents, and as Schultze points out, PACER's largest users are also government entities. In 2009, the DOJ alone paid over $4 million in PACER fees. That's public money transferring from one government entity to another, while the taxpayer supports both the one handling "Accounts Payable" and the one handling "Accounts Receivable."

Public access is a noble goal, but the PACER system as it stands now locks out many members of the public with escalating fees and an intimidating, counterintuitive interface. The priority has shifted from public access to making money. Hopefully, another push towards free availability will get the ball (re)rolling. After all, Joe Lieberman (of all people) asked this very same question all the way back in 2009. Four years later we're still waiting for an answer. And the longer we wait, the more we pay.

Filed Under: access, court filings, excuses, open access, pacer, steve schultze